> I'm not aware of any CAPTCHA solution that would protect you from actual targeted attacks

but that's the entire point of reCaptcha/hCaptcha/every CAPTCHA-as-a-service provider, because they provide good enough security that most websites can use it—if they could be broken, we'd likely see many more attacks that can successfully solve it, rather than services in low-income areas that offer to have real humans solve the problems for payment.